All Apps and Add-ons
Highlighted

Eventgen: Getting "ImportError: No module named sharedctypes". Why is this module missing in 6.4 and how do I add it?

Explorer

I'm trying to run the Eventgen app on a Splunk 6.4 installation. It runs fine in thread mode, but fails in "process" mode with the following errors in the logs:

05-25-2016 09:50:51.182 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/eventgen/bin/eventgen_modinput.py" ImportError: No module named sharedctypes
05-25-2016 10:30:08.534 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/eventgen/bin/eventgen_modinput.py"     from multiprocessing.sharedctypes import RawValue

sharedctypes.py is indeed not found in the python deployment coming with 6.4.

What is the cleanest way to add this module?

0 Karma
Highlighted

Re: Eventgen: Getting "ImportError: No module named sharedctypes". Why is this module missing in 6.4 and how do I add it?

Path Finder

I met this same error today and I guess you're trying to use event gen to do the scripted input, right? if so, you need to put an eventgen.conf file under you app/default folder. this works for me. You can have a try.

BTW, you can move eventgen/lib/eventgendefaults to your app/default folder and rename it as eventgen.conf.
Or just move it:
mv ...../lib/eventgen
defaults ....app/default/eventgen.conf

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.